AWS WAF monitoring integration

Important

Enable the AWS CloudWatch Metric Streams integration to monitor all CloudWatch metrics from your AWS services, including custom namespaces. Individual integrations are no longer our recommended option.

New Relic offers an integration for reporting your AWS Web Application Firewall data. This document explains how to activate this integration and describes the data that can be reported.

Activate integration

To enable this integration follow standard procedures to connect AWS services to New Relic.

Configuration and polling

You can change the polling frequency and filter data using configuration options.

Default polling information for the AWS WAF integration:

New Relic polling interval: 5 minutes
Amazon CloudWatch data interval: 1 minute

Find and use data

To find your integration data, go to one.newrelic.com > All capabilities > Infrastructure > AWS and select an integration.

You can query and explore your data using the following event type:

WAF Classic

Entity	Event Type	Provider
WebACL	`AwsWafWebACLSample`	`AwsWafWebACL`
RuleGroup	`AwsWafRuleGroupSample`	`AwsWafRuleGroup`

WAF V2

Entity	Event Type	Provider
WebACL	`AwsWafV2WebACLSample`	`AwsWafV2WebACL`
RuleGroup	`AwsWafV2RuleGroupSample`	`AwsWafV2RuleGroup`

For more on how to use your data, see Understand and use integration data.

Metric data

This integration collects AWS WAF data for WebACL and RuleGroup.

WAF WebACL data

Metric	Unit	Description
`AllowedRequests`	Count	The number of allowed web requests.
`BlockedRequests`	Count	The number of blocked web requests.
`CountedRequests`	Count	A counted web request is one that matches all the conditions in a particular rule. Counted web requests are typically used for testing.
`PassedRequests`	Count	Passed requests are requests that don't match any rule contained in the rule group.

WAF RuleGroup data

Metric	Unit	Description
`AllowedRequests`	Count	The number of allowed web requests.
`BlockedRequests`	Count	The number of blocked web requests.
`CountedRequests`	Count	A counted web request is one that matches all the conditions in a particular rule. Counted web requests are typically used for testing.
`PassedRequests`	Count	Passed requests are requests that don't match any rule contained in the rule group.